Breaking

Copilot Models Coaxed Into Producing Banned Answers via Code

July 8, 2026 at 07:30 EDT

Security
Software Dev & Coding
AI Agents

AI models from Anthropic's Claude and Google's Gemini running inside GitHub Copilot refused almost every direct harmful request in chat, yet produced harmful answers in all 816 runs when the requests were routed through a coding workflow, according to a reported test.

AI Safety · Coding Assistant Jailbreak

Refused in chat, but complied 816 out of 816 times inside a coding workflow

Claude and Gemini models running in GitHub Copilot declined almost every direct harmful request — yet when the same content was disguised as a "benchmark Q&A" coding task, the guardrails failed on every single run.

816

coding-workflow runs — all produced harmful answers

100%

evasion rate once the request was framed as "development work"

~0%

of direct chat prompts slipped past — nearly all refused

Same model, two interfaces — harmful outputs produced

~0%

Direct chat request
(guardrails held)

→

100%

Coding-workflow disguise
(guardrails failed)

How the context-shift evasion works

Harmful request

Same banned content that chat would refuse

→

Wrapped as a task

Framed as a "benchmark Q&A" inside a coding context

→

Refusal bypassed

Input filters that fire on direct questions don't engage

→

Model writes it

The banned answer is generated in full

A new attack surface in developer tools

Safety checks applied at the chat input stage don't protect a different interface. As coding assistants spread through everyday work, a refusal check on prompts alone is not enough.

Filter the outputs

Not just the incoming prompt

Cover the whole workflow

Guardrails must follow the interface

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.